HIPAA: The Health Insurance Portability and Accountability Act, was created to protect patients’ privacy and security of personal health data. When creating a healthcare app, it is essential to take HIPAA compliance in to careful consideration. When developing a healthcare app, one must adhere to HIPAA compliance throughout all stages of app development. Due to its complex nature, HIPAA law is always changing and evolving, meaning in order to maintain HIPAA compliance, your app must as well.
It’s important to note that ADA and GDPR are two other compliance considerations which also require careful attention, but we won’t be covering these in this article.
#1 Restrict the Storage of PHI on a Phone
Protected Health Information (PHI) needs to always be at the forefront of consideration when building a HIPAA-compliant healthcare app. The 18 PHI identifiers* all deal with identifiable information and healthcare apps need to handle this data safely and securely. It is very important that a healthcare app does not allow users to store PHI on their mobile device.
If the app were to ever accidentally send sensitive information to the wrong patient, that data cannot be recalled if it is saved to the user’s phone. Ideally, data should be pulled from the source EMR or PM system for the user in real-time and never saved on the device. Secondly, it is highly unlikely that a patient has a HIPAA-compliant mobile device, in which case it is a high security risk for patients to have the ability to save PHI to the device.
#2 Keep Notifications Private and Secure
Healthcare apps use notifications to send sensitive and private information to patients. Whether you are sending a patient an email, push notification, or SMS, it is critical that the notification follow strict guidelines. The notification should never give out any specific or identifiable information that pertains to the patient or healthcare organization. If violated, this could lead to a major breach of a patient’s privacy. Anyone has the ability to read a notification when a patient is receiving it on their phone, and for that reason they need to be as secure as possible. A good example of a notification is, “You have a new private message”. On the contrary, a notification should never read, “Hi John, your dermatologist appointment with Dr. Smith is tomorrow.”
#3 Use a Hosting Service that is HIPAA-Compliant
When considering hosting for your healthcare app, HIPAA, once again, is to be taken very seriously. Secure patient information must always be hosted in a cloud service that is HIPAA-compliant. For example, Medical Web Experts, a leading medical web design company, uses Amazon’s HIPAA-compliant cloud as the foundation of their HIPAA-compliant cloud hosting service – the MWE Cloud.
For more information about the development of a healthcare app by expert developers that understand HIPAA compliance, please contact Medical Web Experts today.
*18 PHI Identifiers
1. Names
2. All geographical subdivisions smaller than a State, including street address, city, county, precinct, zip code, and their equivalent geocodes.
3. All elements of dates (except year) for dates directly related to an individual, including birth date, admission date, discharge date, date of death, and more.
4. Phone numbers
5. Fax numbers
6. Electronic mail addresses
7. Social Security numbers
8. Medical record numbers
9. Health plan beneficiary numbers
10. Account numbers
11. Certificate/license numbers
12. Vehicle identifiers and serial numbers, including license plate numbers
13. Device identifiers and serial numbers
14. Web Universal Resource Locators (URLs)
15. Internet Protocol (IP) address numbers
16. Biometric identifiers, including finger and voice prints
17. Full face photographic images and any comparable images
18. Any other unique identifying number, characteristic, or code (note this does not mean the unique code assigned by the investigator to code the data)
The Editorial Team at Healthcare Business Today is made up of skilled healthcare writers and experts, led by our managing editor, Daniel Casciato, who has over 25 years of experience in healthcare writing. Since 1998, we have produced compelling and informative content for numerous publications, establishing ourselves as a trusted resource for health and wellness information. We offer readers access to fresh health, medicine, science, and technology developments and the latest in patient news, emphasizing how these developments affect our lives.
